fix(cas-reference-product): harden CI workflow permissions and fix failure-chaining bugs

[OgeonX-Ai]

Summary

• Hardens ci.yml, codeql.yml, and pages.yml workflow permissions/timeouts
• Fixes workflow failure chaining preserved through the foundry/api layers
• Sanitizes provider span failures for security
• Syncs the immutable contract registry release (v0.1.0 schema binary updates) and extends test_service_factory.py coverage

13 files changed, +16/-4.

Part of the Phase 30 release train (.planning/phases/30-release-train-and-branch-hygiene/).

🤖 Generated with Claude Code